Files
Abstract
The use of digital technology continues to expand in K-12 public schools, creating potential security vulnerabilities for district networks. As technology use grows, K-12 institutions have seen an increase in cyber attacks, which can have a profound impact on stakeholders in the organization. The purpose of this study was to examine how K-12 Information Technology (IT) administrators, those closest to the attack, experienced a cyber attack and how it impacted their security processes and policies. A case study methodology, including interviews and artifact collection, was used to understand the lived experience of the participants, and themes emerged from inductive coding of the data. Regarding how K-12 IT administrators experienced a cyber attack, data revealed the themes of “Nobody’s Seen Something Like This Before,” and “The End”. Participants described their experience during the cyber attack as unlike anything they had encountered before, and all participants had different perspectives on when they considered the attack over. Relating to how experiencing a cyber attack impacted the cybersecurity policies and processes of the IT administrators, the themes of “Finding a Voice” and “Trust Nothing” emerged from the data. Participants shared that after experiencing a cyber attack they found a voice both internally within the department and externally with other departments in the school district. Participants also expressed that after the attack, they did not trust that they were ever safe from potential cyber threats. This study has implications for K-12 IT administrators, as well as other K-12 district leaders. Implications for K-12 administrators include fostering effective communication with IT administrators during a cyber attack, and proactively promoting communication between IT administrators, between IT administrators and other departments in the school district, and between school districts that have experienced an attack and those that have not. In addition, the study highlights the need to support the mental health of K-12 IT administrators after an attack, maintaining robust cybersecurity measures to protect school districts, and the potential importance of collective efficacy in core IT team decision making after a cyber attack. This study adds to the limited research on how K-12 IT administrators experience a cyber attack, and additional research is needed to further understand how IT administrators, district leaders, staff, and students experience a cyber threat.